topic Select the right index based on value in Dropdown in Splunk Search

Select the right index based on value in Dropdown

sandmountain — Wed, 27 Sep 2023 21:07:13 GMT

I have a dropdown with two values PROD and TEST. Based on my selection in my panels in the dashboard I have to choose a different index for my search. How can I do this?

Example of two searches: (which also includes other tokens. These can be ignored. Both searches work if I directly put in the right index

1/
index=<IF PROD then AAA_prod_index else AAA_test_index> sourcetype IN (abc:edge:api, abc:edge:api) proxy!="ow*" $client_token$ $target_token$ |
rex mode=sed field=proxy "s#^(.*?)_(.*)$#*_\2#" | stats count by proxy

2/
index=<IF PROD then BBB_prod_index else BBB_test_index> sourcetype=accesslog tenant=$tenant_token$ | stats count by HTTPStatusCode

Re: Select the right index based on value in Dropdown

bowesmana — Wed, 27 Sep 2023 22:08:51 GMT

Your dropdown token, for example

<input type="dropdown" token="environment"> <label>Environment</label> <choice value="prod">PROD</choice> <choice value="test">TEST</choice> </input> ...

and then the searches just use that token

index=AAA_$environment$_index sourcetype IN (abc:edge:api, abc:edge:api) proxy!="ow*" $client_token$ $target_token$ | rex mode=sed field=proxy "s#^(.*?)_(.*)$#*_\2#" | stats count by proxy ---- index=BBB_$environment$_index sourcetype=accesslog tenant=$tenant_token$ | stats count by HTTPStatusCode

Re: Select the right index based on value in Dropdown

sandmountain — Thu, 28 Sep 2023 13:45:36 GMT

Thx that worked fine

Re: Select the right index based on value in Dropdown

bowesmana — Fri, 29 Sep 2023 00:21:39 GMT

Please mark the answer as a solution for others to benefit from - thanks